{
 "id": "WPSEC-2026-1630",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1630/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1630/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1630/index.md",
 "title": "Magyar WooCommerce kiegészítések <= 2026.2.3 - Cross-Site Request Forgery to Product Price History Deletion",
 "description": "The surbma-magyar-woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery via the price history deletion action of the standalone product price history page in all versions up to, and including, 2026.2.3, due to missing nonce validation on the 'hc-product_price_history' GET request. This makes it possible for unauthenticated attackers to delete the stored price history of any product via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.",
 "plugin": {
  "slug": "surbma-magyar-woocommerce",
  "name": "Magyar WooCommerce kiegészítések",
  "full_name": "HuCommerce | Magyar WooCommerce kiegészítések",
  "wordpress_org": "https://wordpress.org/plugins/surbma-magyar-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/surbma-magyar-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/surbma-magyar-woocommerce"
 },
 "type": "CSRF",
 "cwe": [
  "CWE-352"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2026.2.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2026.2.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2026.2.4",
 "remediation": "Update to 2026.2.4 or later.",
 "fix_released": "2026-10-24T00:21:34+00:00",
 "published": "2026-10-25T00:41:03+00:00",
 "updated": "2026-10-24T10:53:10.807097+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1630/",
  "https://plugins.svn.wordpress.org/surbma-magyar-woocommerce/tags/2026.2.4/",
  "https://wordpress.org/plugins/surbma-magyar-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/surbma-magyar-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-25"
 }
}